Director - Enterprise Risk Management

Summary

The Director of Enterprise Risk Management ("ERM") is responsible for developing, implementing, and overseeing the credit union's enterprise-wide risk management program across a complex, nationwide financial institution with $9 billion in assets. This position involves managing and mitigating risk across all organizational departments and channels. This role provides strategic and operational leadership of enterprise risk functions, including physical security, vendor and third-party risk management, business continuity and disaster recovery, emergency preparedness, operational risk assessments, risk scoring methodologies, and enterprise tabletop exercises.

The Director of ERM partners closely with executive leadership, business units and regulators to identify, assess, mitigate, and monitor risks that could impact the organization's operations, reputation, members, employees, or strategic objectives.

This position requires a proactive leader who can build scalable enterprise risk management frameworks while supporting innovation, growth, and operational resilience across a geographically dispersed organization.

Duties & Responsibilities

Enterprise Risk Management

* Lead and administer the credit union's enterprise risk management framework, including risk identification, assessment, mitigation, monitoring, continual improvement, and reporting activities.

* Develop and maintain enterprise risk methodologies, risk scoring models, risk appetite metrics, and key risk indicators (KRIs).

* Coordinate enterprise-wide risk assessments, ensure risks are appropriately documented, tracked, and monitor risk metrics to ensure timely escalation and containment of concerns.

* Monitor and assess the impact of enterprise risks, ensuring effective risk identification, prioritization, and mitigation strategies are in place across all organizational functions, creating a unified approach to risk management throughout the credit union.

* Oversee swift triage, containment, and resolution efforts across cross-functional teams.

* Lead root-cause investigations and lessons learned when incidents occur.

* Manage remediation, recommend and validate risk reduction actions and monitor for effectiveness.

* Provide strategic guidance and data-backed reports, dashboards, and presentations for executive leadership ensuring they are informed of the emerging risks, risk mitigation strategies, and the overall risk landscape.

* Assess risks associated with strategic objectives and key initiatives, ensuring informed decision-making by integrating risk analysis into planning processes and confirming that all credit union initiatives are supported by thorough, data-driven risk assessments.

* Stay ahead of emerging risk trends, evaluate new technologies, and ensure that enterprise risk management frameworks remain agile to address evolving threats, safeguarding the credit union's reputation, and financial stability.

* Support executive leadership in defining and refining the credit union's risk appetite and tolerance, ensuring that risk management practices align with the credit union's mission, vision, and business objectives.

* Promote a strong culture of risk awareness and accountability throughout the organization by collaborating with department heads across the organization to integrate risk management practices into operational processes, ensuring consistency, accuracy, and compliance throughout the credit union's operations.

Business Continuity, Disaster Recovery & Emergency Management

* Oversee the credit union's business continuity, disaster recovery, and emergency preparedness programs.

* Lead and maintain the enterprise Business Impact Analysis (BIA) program to identify critical processes, recovery time objectives, recovery point objectives, and resource dependencies.

* Ensure disaster recovery and business continuity plans are maintained, tested, and updated regularly.

* Coordinate and facilitate enterprise-wide tabletop exercises, incident simulations, and continuity testing.

* Lead response coordination during operational disruptions, emergencies, or crisis events.

* Assess and monitor third-party and vendor business continuity capabilities to ensure resilience across critical external dependencies.

* Partner with Information Security, Facilities, Operations, and executive leadership to strengthen organizational resilience.

* Establish and track recovery priorities and service restoration timelines to minimize operational and member impact during disruptions.

* Provide reporting and insights to executive leadership on continuity risks, testing results, gaps, and remediation progress.

Vendor & Third-Party Risk Management

* Direct the third-party/vendor risk management program, including risk assessments, due diligence, contract review coordination, ongoing monitoring, and issue remediation.

* Assess and validate vendors' information security, business continuity, and disaster recovery capabilities to ensure resilience of outsourced services.

*…